Install Kestrel and Workgroups

Use your authorized Hetzner SSH username and identity file. The page is public; package downloads require authorized SSH access.

curl -fsSL 'https://kestrel.hetz.lxis.net/install.sh' | /bin/sh -s -- SSH_USER "$HOME/.ssh/id_ed25519"

This bootstrap selects an exact verified release: linux-amd64: pilot-20261017-release01; darwin-arm64: pilot-20261017-release01. The command stays the same when this page's default release changes.

Initial trust comes from this HTTPS host. The page, bootstrap and registry share Hetzner: a host/admin compromise can substitute both bootstrap and registry.

The installer prints a PATH line; it does not edit your shell files or restart running tools.